What did annoy me however that I still got the red address bar in my browser, indicating that the website is insecure. By default, the AppController uses a self-signed certificate – which is, ofcourse, untrusted. So there are two ways to solve this; the simplest one is just to trust the self-signed cert by importing it. The other is to create an official certificate to be used. The problem is that the documentation on edocs.citrix.com is flawed, and will not work. So I had to figure it out myself. That’s what this post is about.

I’m not going to elaborate on how certificates work, I assume you have some working knowledge on the matter. To create the certificate we follow three steps:

Create a certificate request for the FQDN you’ll be using for the AppController

1. Log on to the console of the AppController (eg with Putty)
2. Remove the current private key
   sudo keytool -delete
-alias tomcat -storepass changeit -keystore /root/.keystore
3. Create a new key
   sudo /usr/java/jdk1.6.0_21/bin/keytool -keysize 2048 -genkey -alias tomcat -keyalg RSA -storepass changeit -keystore /root/.keystore
   You’ll be asked to fill in the details for the cert request. Important: When asked for “What is your first and last name?” enter the FQDN of the AppController, not your real first and last name!

Request a certificate from your Certificate Authority

1. Create a certificate request
   sudo /usr/java/jdk1.6.0_21/bin/keytool -certreq -keyalg RSA -alias tomcat -file /home/admin/certreq.csr -storepass changeit -keystore /root/.keystore
2. Use a SCP client, like WinSCP, to download the certificate request (/home/admin/certreq.csr) from the AppController onto your PC.
3. Use the certificate request (it’s formatted in Base64 BTW) to request a certificate from your CA (your enterprise CA or a public CA). Download the certificate in PEM/Base64 format.

Installing the certificate

1. Upload the certificate chain (make sure they’re all in PEM/Base64) to the AppController. Do this again with your SCP client. Upload the certificates to /home/admin/
2. Import the root and intermediate certificates with
   sudo /usr/java/jdk1.6.0_21/bin/keytool -import -trustcacerts -alias root -file /home/admin/<root certificate> -storepass changeit -keystore /root/.keystore
3. Finally, import the server certificate:
   sudo /usr/java/jdk1.6.0_21/bin/keytool -import -trustcacerts -alias tomcat -file /home/admin/<certificate> -storepass changeit -keystore /root/.keystore
4. Reboot

There, now you have that nice white or green address bar

First, you start with adding the necessary Citrix PowerShell modules with (you perform this on a XD Controller on another machine with the XenDesktop SDK installed):

Add-PSSnapin Citrix.*

For convenience, we’re going to map the XDFarm policies to a drive, so we can browse it easily:

New-PSDrive XDFarm -root \ -PSProvider CitrixGroupPolicy -Controller <FQDN of a XD Controller>

From there you can browse the XD Farm policies easily:

Set-Location XDFarm:\
PS XDFarm:\> Get-ChildItem
User
Computer

If, for example, you would like to add multiple session printers to the Unfiltered User policy you would perform the following:

Set-ItemProperty XDFarm:\User\Unfiltered\Settings\ICA\printing\SessionPrinters
-name Values
-value @("<pathA>,model=<modelA>,location=<locationA>","<pathB>,model=<modelB>,location=<locationB>")

So, there you have it

Do note that you’re working with an in-memory version of the CitrixGroupPolicy object. That means that if you change settings in the Citrix Desktop Studio, this won’t be reflected in the current instance. Changes that you make however will be automatically written back to the XenDesktop database.

One important thing is how to control information in the world of Twitter’s, Facebook’s and Google +’s of this world. As you know, these services rise and fall, and when they fall, your content does too. Then there’s obviously features that are redundantly provided by many of such services, like giving a status update. What’s also annoying is that you need to update each and every service (why are you using them otherwise?) and that becomes a chore quickly.

So what I’m about to do, is to centralize everything in my personal WordPress blog. It’s hosted by myself, so it’s my content and I can do anything I’d like to do with it. And to make life easier, I’m going to use the Twitter Tools plug-in to automatically tweet updates. In Facebook, I’ve integrated the Twitter app, so tweets should also show up as Facebook update. So yeah, it’s kind of experimental

Let’s see how this works out…

• Is CDM policy configured? Correctly applied? (Yep)
• Are no group policies configured which might be blocking CDM? (Nope)
• Is CDM blocked on the ICA-tcp protocol? (Nope)
• Is CDM working over RDP? (Yep)

Well, all seemed to be configured correctly. Since XenApp 6.5 is (at this time of writing) a Technical Preview, I almost filed it as a bug.

For a last attempt I turned to CTX238200 – Troubleshooting Client Drive Mapping. I verified all points meticulously until I got to point 7:

7. Ensure that Client Network is visible under Network Neighborhood. If it is not, follow the steps listed below:
a. Start Registry Editor (Regedt32.exe) and go to the following key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order
The
value for ProviderOrder contained only LanmanWorkstation.
Add CdmService, so
that the Value now reads “CdmService,LanmanWorkstation.”

b. For Presentation Server 4.5, ensure the path defined under the
CommonFilesDir value from
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion is
correct.

c. Restart the server

So I checked HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order, and found no CdmService, only LanManWorkstation. Hey, that could be it! So I put CdmService in there, but unfortunately, after a reboot, the drives still weren’t mapped. I turned to another environment I’ve setup at another customer with XenApp 6, where I knew that CDM was working fine. So I checked the Order value there:

Hmm, PICAClientNetwork looks interesting. And lo and behold, with PICAClientNetwork in the Order key (and rebooting), CDM worked!

So next time, you have troubles with CDM on XenApp 6(.5) and all seems to be configured well, don’t forget this one

Hmm, that’ll be for tomorrow.